As more and more computers and other computing devices are interconnected through various networks, such as the Internet, computer security has become increasingly more important, particularly from invasions or attacks delivered over a network or over an information stream. As those skilled in the art will recognize, these attacks come in many different forms, including, but certainly not limited to, computer viruses, computer worms, system component replacements, denial of service attacks, even misuse/abuse of legitimate computer system features, all of which exploit one or more computer system vulnerabilities for illegitimate purposes. While those skilled in the art will realize that the various computer attacks are technically distinct from one another, for purposes of the present invention and for simplicity in description, all malicious computer programs that spread on computer networks, such as the Internet, will be generally referred to hereinafter as computer malware or, more simply, malware.
When a computer system is attacked or “infected” by computer malware, the adverse results are varied, including disabling system devices; erasing or corrupting firmware, applications, or data files; transmitting potentially sensitive data to another location on the network; shutting down the computer system; or causing the computer system to crash. Yet another pernicious aspect of many, though not all, computer malware is that an infected computer system is used to infect other systems.
A traditional defense against computer malware and, particularly, against computer viruses and worms, is commercially available antivirus software applications. Generally described, an antivirus software application scans data, looking for identifiable patterns associated with computer malware. Upon detecting a pattern associated with computer malware, the antivirus software application may respond by quarantining the malware or deleting the malware. Unfortunately, antivirus software applications typically work best with known, identifiable computer malware. Frequently, this is done by matching patterns within data to what is referred to as a “signature” of the malware.
Typically, most operations performed by existing antivirus software applications occur when an operating system is in “user mode.” As is known to those skilled in the art and others, computer programs such as antivirus software applications may execute in either “kernel mode” or “user mode.” “Kernel mode” refers to processing that occurs at the most privileged and protected level of the operating system. Kernel mode programs reside in protected memory at all times and provide basic operating system services. “User mode” refers to processing that occurs at the application layer where access to kernel mode data is not available. Previously a vendor of an antivirus software application that needed to access information and features available from kernel mode needed to build a kernel mode filter that interfaced with an operating system. Unfortunately, each antivirus software vendor was required to develop a unique filter to access features available from kernel mode, such as the input/output (hereinafter referred to as “I/O”), scheduled to occur on a computing device. Moreover, if each antivirus software application has a corresponding kernel mode filter to perform essentially the same task, a computing device suffers the performance burden of having duplicative code executing in several disparate filters all loaded in the kernel. Still another disadvantage of existing technologies is that the user mode interface is inconsistent, non-uniform, and prone to errors. Accordingly, a need exists for a mechanism by which I/O scheduled to occur on a computing device is available to antivirus software applications without requiring an antivirus software vendor to implement a kernel mode filter.
Numerous software vendors market antivirus software applications and maintain an ever-growing database of malware signatures. In fact, one of the most important assets of antivirus software vendors is the knowledge base of signatures collected from known malware. However, commercially available antivirus software applications are not always compatible with each other. For example, in some instances, when two different antivirus software applications are installed on a computing device, data conflicts are known to occur. As a result, users are unable to install multiple antivirus software applications on a computing device and receive the benefit of each application's knowledge base. Accordingly, a need exists for a mechanism to aggregate the knowledge base of a plurality of antivirus software applications installed on the same computing device.